Qualys Vulnerability R&D Lab has released new vulnerability checks in the Qualys Cloud Platform to protect organizations against 71 vulnerabilities that were fixed in 6 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Microsoft has released 6 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
KB Articles associated with the update:
1) KB4093109
2) KB4093119
3) KB4093107
4) KB4088782
5) KB4093111
QID Detection Logic (Authenticated):
Operating Systems: All versions of Windows 10 and Windows Server 2016
This QID checks for the file version of %windir%\System32\edgehtml.dll
The following KBs are checked:
The patch version is 11.0.10240.17831 (KB4093111)
The patch version is 11.0.10586.1540(KB4093109)
The patch version is 11.0.14393.2189(KB4093119)
The patch version is 11.0.15063.1029(KB4093107)
The patch version is 11.0.16299.371(KB4093112)
1) Remote Code Execution
2) Information Disclosure
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft Security Update Guide
Microsoft has released Cumulative Security Updates for Internet Explorer which addresses various vulnerabilities found in Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10) and Internet Explorer 11 (IE 11). The security updated is rated Moderate for for Internet Explorer 9 (IE 9) and Internet Explorer 10 (IE 10) and Critical for Internet Explorer 11 (IE 11). The most severe of the vulnerabilities could allow remote code execution.
KB Articles associated with the Update:
1)4093118
2)4092946
3)4093109
4)4093114
5)4093119
6)4093111
7)4093107
8)4093112
9)4093123
QID Detection Logic (Authenticated):
Operating Systems: Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
This QID checks for the file version of %windir%\System32\mshtml.dll
The following KBs are checked:
The patch version is 11.0.9600.18978 (KB4093118 or KB4092946 or KB4093114)
The patch version is 11.0.10240.17831 (KB4093111)
The patch version is 11.0.10586.1540 (KB4093109)
The patch version is 11.0.14393.2189 (KB4093119)
The patch version is 11.0.15063.1029 (KB4093107)
The patch version is 11.0.16299.371(KB4093112)
The patch version is 10.0.9200.22411 (KB4092946 or KB4093123)
The patch version is 9.0.8112.21213 (KB4092946)
1) Remote Code Execution
2) Information Disclosure
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft Security Update Guide
This security updates contain following KBs:
KB4011586
KB4011628
KB4011712
KB4011717
KB4011719
KB4018288
KB4018311
KB4018319
KB4018328
KB4018330
KB4018336
KB4018337
KB4018339
KB4018341
KB4018342
KB4018343
KB4018344
KB4018347
KB4018350
KB4018353
KB4018354
KB4018355
KB4018356
KB4018357
KB4018359
KB4018360
KB4018362
QID Detection Logic:
This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected office system.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft Office and Microsoft Office Services and Web Apps Security Update April 2018(Office)
Affected Software:
Microsoft Visual Studio 2010 Service Pack 1
Microsoft Visual Studio 2012 Update 4
Microsoft Visual Studio 2013 Update 5
Microsoft Visual Studio 2015 Update 3
Microsoft Visual Studio 2017
Microsoft Visual Studio 2017 Version 15.6.6
Microsoft Visual Studio 2017 Version 15.7 Preview
QID Detection Logic:
This authenticated QID verifies the file versions of mspdbcore.dll from the following registry entries:
HKLM\SOFTWARE\Microsoft\VisualStudio.0\InstallDir
HKLM\SOFTWARE\Wow6432Node\Microsoft\VisualStudio.0\InstallDir
HKLM\SOFTWARE\Microsoft\VisualStudio.0\InstallDir
HKLM\SOFTWARE\Wow6432Node\Microsoft\VisualStudio.0\InstallDir
NOTE: As of now, this QID does not check for Microsoft Visual Studio 2017 patches.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2018-1037
QID Detection Logic:
Operating Systems: Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
This authenticated QID checks for the file version of %windir%\System32\Macromed\Flash\Flash.ocx for file versions lesser than 29.0.0.140.
KB Articles associated with this update are: ADV180007
Patches:
The following are links for downloading patches to fix these vulnerabilities:
KB4093110
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. (CVE-2018-1038)
An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address. (CVE-2018-0887)
A security feature bypass vulnerability exists when Active Directory incorrectly applies Network Isolation settings. To exploit this vulnerability, an attacker could run a specially crafted application. (CVE-2018-0890)
A denial of service vulnerability exists in the HTTP 2.0 protocol stack (HTTP.sys) when HTTP.sys improperly parses specially crafted HTTP 2.0 requests. (CVE-2018-0956)
An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system. (CVE-2018-0957)
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory.(CVE-2018-0960)
QID Detection Logic (Authenticated):
Operating Systems: Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
This QID checks for following file versions %windir%\System32\Win32k.sys for all affected OS except Windows 10 and Windows 16:
The patch version of 6.0.6002.24344 (KB4093224)
The patch version of 6.1.7601.24093 (KB4093108 or KB4093118)
The patch version of 6.2.9200.22413 (KB4093122 or KB4093123)
The patch version of 6.3.9600.18979 (KB4093114 or KB4093115)
This QID checks for following file versions %windir%\System32\Win32kfull.sys.exe for Windows 10 and Windows 16:
The patch version of 10.0.10240.17831 (KB4093111)
The patch version of 10.0.10586.1540 (KB4093109)
The patch version of 10.0.14393.2189 (KB4093119)
The patch version of 10.0.15063.1029 (KB4093107)
The patch version of 10.0.16299.371 (KB4093112)
This QID checks for following files and its versions for Windows 2008 SP2:
The patch version of %windir%\System32\Advapi32.dll 6.0.6002.24335 (KB4093478)
The patch version of %windir%\System32\Msexcl40.dll 4.0.9801.3 (KB4093257)
The patch version of %windir%\system32\Atmfd.dll 5.1.2.253 (KB4093223)
The patch version of %windir%\System32\Basecsp.dll 6.0.6002.24329 (KB4093227)
The patch version of %windir%\system32\Wsnmp32.dll 6.0.6002.24398 (KB4091756)
Note: KB4091756 was re-released on June 12, 2018 for Windows Server 2008 SP2
Patches:
The following are links for downloading patches to fix these vulnerabilities:
KB4091756
KB4093107
KB4093108
KB4093109
KB4093111
KB4093112
KB4093114
KB4093115
KB4093118
KB4093119
KB4093122
KB4093123
KB4093223
KB4093224
KB4093227
KB4093257
KB4093478
KB4100480
These new vulnerability checks are included in Qualys vulnerability signature 2.4.304-5. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
To perform a selective vulnerability scan, configure a scan profile to use the following options:
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Platforms and Platform Identification
For more information, customers may contact Qualys Technical Support.
The Qualys Cloud Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.